C:\BuildAgent\work\a197c1fa8a223363\downloader\Release\downloader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4a47530df880c1bbd580521ed66b4350N.exe
Resource
win7-20240729-en
General
-
Target
4a47530df880c1bbd580521ed66b4350N.exe
-
Size
331KB
-
MD5
4a47530df880c1bbd580521ed66b4350
-
SHA1
23029f13faeac7434bbf84af70215eaf3bd02c32
-
SHA256
74ebce1dd82a8188c45a3fbf047359f4c4b387f750a8c1c32fd4dfdae2679bfc
-
SHA512
dca694dc1c6b41bb89d8164f70b65b2ba620409f3faa457f4ddfd22c1990423424472fc0f8465287e7e123e5d63ce51dae64928e3863453dffb4e1696b54b27a
-
SSDEEP
6144:f5lJq1yqe+3LIonknlSRRWYfpOLf0BBV+UdvrEFp7hKT52i:hq1yqe+3vnknU+YfpAfWBjvrEH7W52i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a47530df880c1bbd580521ed66b4350N.exe
Files
-
4a47530df880c1bbd580521ed66b4350N.exe.exe windows:5 windows x86 arch:x86
a05d88650e5594db2afe874ec2674b55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
secur32
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
kernel32
GetCurrentProcess
SetHandleInformation
WaitForSingleObject
Sleep
GetVersionExW
GetExitCodeProcess
GetLastError
CloseHandle
GetCurrentProcessId
HeapAlloc
HeapFree
InterlockedDecrement
GetProcessHeap
WideCharToMultiByte
GetModuleFileNameW
MultiByteToWideChar
DuplicateHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
CreateProcessW
GetCommandLineW
CreateFileW
HeapReAlloc
GetConsoleMode
HeapSize
OutputDebugStringW
CompareStringW
LoadLibraryExW
SetEnvironmentVariableW
GetStringTypeW
GetConsoleCP
SetEndOfFile
ReadConsoleW
ReadFile
SetLastError
WriteFile
FlushFileBuffers
GetProcAddress
GetModuleHandleExW
ExitProcess
FreeEnvironmentStringsW
LCMapStringW
QueryPerformanceCounter
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetEnvironmentStringsW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
lstrlenA
LocalFree
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
user32
CharLowerW
wsprintfW
advapi32
ConvertSidToStringSidW
GetLengthSid
LsaNtStatusToWinError
RegOpenKeyExW
RegQueryValueExW
CopySid
GetTokenInformation
OpenProcessToken
RegCloseKey
shell32
ShellExecuteExW
SHCreateDirectoryExW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
OleRun
oleaut32
SysFreeString
VariantInit
VariantClear
GetErrorInfo
SysAllocString
urlmon
URLOpenBlockingStreamW
wintrust
WinVerifyTrust
ws2_32
send
freeaddrinfo
socket
WSACleanup
shutdown
htons
WSAGetLastError
getaddrinfo
htonl
WSAStartup
connect
closesocket
recv
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 79KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE